scan.c 28 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075
  1. /*
  2. * Scanning implementation
  3. *
  4. * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
  5. * Copyright 2004, Instant802 Networks, Inc.
  6. * Copyright 2005, Devicescape Software, Inc.
  7. * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
  8. * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
  9. *
  10. * This program is free software; you can redistribute it and/or modify
  11. * it under the terms of the GNU General Public License version 2 as
  12. * published by the Free Software Foundation.
  13. */
  14. #include <linux/if_arp.h>
  15. #include <linux/etherdevice.h>
  16. #include <linux/rtnetlink.h>
  17. #include <linux/pm_qos.h>
  18. #include <net/sch_generic.h>
  19. #include <linux/slab.h>
  20. #include <linux/export.h>
  21. #include <net/mac80211.h>
  22. #include "ieee80211_i.h"
  23. #include "driver-ops.h"
  24. #include "mesh.h"
  25. #define IEEE80211_PROBE_DELAY (HZ / 33)
  26. #define IEEE80211_CHANNEL_TIME (HZ / 33)
  27. #define IEEE80211_PASSIVE_CHANNEL_TIME (HZ / 9)
  28. void ieee80211_rx_bss_put(struct ieee80211_local *local,
  29. struct ieee80211_bss *bss)
  30. {
  31. if (!bss)
  32. return;
  33. cfg80211_put_bss(local->hw.wiphy,
  34. container_of((void *)bss, struct cfg80211_bss, priv));
  35. }
  36. static bool is_uapsd_supported(struct ieee802_11_elems *elems)
  37. {
  38. u8 qos_info;
  39. if (elems->wmm_info && elems->wmm_info_len == 7
  40. && elems->wmm_info[5] == 1)
  41. qos_info = elems->wmm_info[6];
  42. else if (elems->wmm_param && elems->wmm_param_len == 24
  43. && elems->wmm_param[5] == 1)
  44. qos_info = elems->wmm_param[6];
  45. else
  46. /* no valid wmm information or parameter element found */
  47. return false;
  48. return qos_info & IEEE80211_WMM_IE_AP_QOSINFO_UAPSD;
  49. }
  50. struct ieee80211_bss *
  51. ieee80211_bss_info_update(struct ieee80211_local *local,
  52. struct ieee80211_rx_status *rx_status,
  53. struct ieee80211_mgmt *mgmt, size_t len,
  54. struct ieee802_11_elems *elems,
  55. struct ieee80211_channel *channel)
  56. {
  57. bool beacon = ieee80211_is_beacon(mgmt->frame_control);
  58. struct cfg80211_bss *cbss;
  59. struct ieee80211_bss *bss;
  60. int clen, srlen;
  61. enum nl80211_bss_scan_width scan_width;
  62. s32 signal = 0;
  63. if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
  64. signal = rx_status->signal * 100;
  65. else if (local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC)
  66. signal = (rx_status->signal * 100) / local->hw.max_signal;
  67. scan_width = NL80211_BSS_CHAN_WIDTH_20;
  68. if (rx_status->flag & RX_FLAG_5MHZ)
  69. scan_width = NL80211_BSS_CHAN_WIDTH_5;
  70. if (rx_status->flag & RX_FLAG_10MHZ)
  71. scan_width = NL80211_BSS_CHAN_WIDTH_10;
  72. cbss = cfg80211_inform_bss_width_frame(local->hw.wiphy, channel,
  73. scan_width, mgmt, len, signal,
  74. GFP_ATOMIC);
  75. if (!cbss)
  76. return NULL;
  77. bss = (void *)cbss->priv;
  78. if (beacon)
  79. bss->device_ts_beacon = rx_status->device_timestamp;
  80. else
  81. bss->device_ts_presp = rx_status->device_timestamp;
  82. if (elems->parse_error) {
  83. if (beacon)
  84. bss->corrupt_data |= IEEE80211_BSS_CORRUPT_BEACON;
  85. else
  86. bss->corrupt_data |= IEEE80211_BSS_CORRUPT_PROBE_RESP;
  87. } else {
  88. if (beacon)
  89. bss->corrupt_data &= ~IEEE80211_BSS_CORRUPT_BEACON;
  90. else
  91. bss->corrupt_data &= ~IEEE80211_BSS_CORRUPT_PROBE_RESP;
  92. }
  93. /* save the ERP value so that it is available at association time */
  94. if (elems->erp_info && (!elems->parse_error ||
  95. !(bss->valid_data & IEEE80211_BSS_VALID_ERP))) {
  96. bss->erp_value = elems->erp_info[0];
  97. bss->has_erp_value = true;
  98. if (!elems->parse_error)
  99. bss->valid_data |= IEEE80211_BSS_VALID_ERP;
  100. }
  101. /* replace old supported rates if we get new values */
  102. if (!elems->parse_error ||
  103. !(bss->valid_data & IEEE80211_BSS_VALID_RATES)) {
  104. srlen = 0;
  105. if (elems->supp_rates) {
  106. clen = IEEE80211_MAX_SUPP_RATES;
  107. if (clen > elems->supp_rates_len)
  108. clen = elems->supp_rates_len;
  109. memcpy(bss->supp_rates, elems->supp_rates, clen);
  110. srlen += clen;
  111. }
  112. if (elems->ext_supp_rates) {
  113. clen = IEEE80211_MAX_SUPP_RATES - srlen;
  114. if (clen > elems->ext_supp_rates_len)
  115. clen = elems->ext_supp_rates_len;
  116. memcpy(bss->supp_rates + srlen, elems->ext_supp_rates,
  117. clen);
  118. srlen += clen;
  119. }
  120. if (srlen) {
  121. bss->supp_rates_len = srlen;
  122. if (!elems->parse_error)
  123. bss->valid_data |= IEEE80211_BSS_VALID_RATES;
  124. }
  125. }
  126. if (!elems->parse_error ||
  127. !(bss->valid_data & IEEE80211_BSS_VALID_WMM)) {
  128. bss->wmm_used = elems->wmm_param || elems->wmm_info;
  129. bss->uapsd_supported = is_uapsd_supported(elems);
  130. if (!elems->parse_error)
  131. bss->valid_data |= IEEE80211_BSS_VALID_WMM;
  132. }
  133. if (beacon) {
  134. struct ieee80211_supported_band *sband =
  135. local->hw.wiphy->bands[rx_status->band];
  136. if (!(rx_status->flag & RX_FLAG_HT) &&
  137. !(rx_status->flag & RX_FLAG_VHT))
  138. bss->beacon_rate =
  139. &sband->bitrates[rx_status->rate_idx];
  140. }
  141. return bss;
  142. }
  143. void ieee80211_scan_rx(struct ieee80211_local *local, struct sk_buff *skb)
  144. {
  145. struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
  146. struct ieee80211_sub_if_data *sdata1, *sdata2;
  147. struct ieee80211_mgmt *mgmt = (void *)skb->data;
  148. struct ieee80211_bss *bss;
  149. u8 *elements;
  150. struct ieee80211_channel *channel;
  151. size_t baselen;
  152. struct ieee802_11_elems elems;
  153. if (skb->len < 24 ||
  154. (!ieee80211_is_probe_resp(mgmt->frame_control) &&
  155. !ieee80211_is_beacon(mgmt->frame_control)))
  156. return;
  157. sdata1 = rcu_dereference(local->scan_sdata);
  158. sdata2 = rcu_dereference(local->sched_scan_sdata);
  159. if (likely(!sdata1 && !sdata2))
  160. return;
  161. if (ieee80211_is_probe_resp(mgmt->frame_control)) {
  162. /* ignore ProbeResp to foreign address */
  163. if ((!sdata1 || !ether_addr_equal(mgmt->da, sdata1->vif.addr)) &&
  164. (!sdata2 || !ether_addr_equal(mgmt->da, sdata2->vif.addr)))
  165. return;
  166. elements = mgmt->u.probe_resp.variable;
  167. baselen = offsetof(struct ieee80211_mgmt, u.probe_resp.variable);
  168. } else {
  169. baselen = offsetof(struct ieee80211_mgmt, u.beacon.variable);
  170. elements = mgmt->u.beacon.variable;
  171. }
  172. if (baselen > skb->len)
  173. return;
  174. ieee802_11_parse_elems(elements, skb->len - baselen, false, &elems);
  175. channel = ieee80211_get_channel(local->hw.wiphy, rx_status->freq);
  176. if (!channel || channel->flags & IEEE80211_CHAN_DISABLED)
  177. return;
  178. bss = ieee80211_bss_info_update(local, rx_status,
  179. mgmt, skb->len, &elems,
  180. channel);
  181. if (bss)
  182. ieee80211_rx_bss_put(local, bss);
  183. }
  184. static void
  185. ieee80211_prepare_scan_chandef(struct cfg80211_chan_def *chandef,
  186. enum nl80211_bss_scan_width scan_width)
  187. {
  188. memset(chandef, 0, sizeof(*chandef));
  189. switch (scan_width) {
  190. case NL80211_BSS_CHAN_WIDTH_5:
  191. chandef->width = NL80211_CHAN_WIDTH_5;
  192. break;
  193. case NL80211_BSS_CHAN_WIDTH_10:
  194. chandef->width = NL80211_CHAN_WIDTH_10;
  195. break;
  196. default:
  197. chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
  198. break;
  199. }
  200. }
  201. /* return false if no more work */
  202. static bool ieee80211_prep_hw_scan(struct ieee80211_local *local)
  203. {
  204. struct cfg80211_scan_request *req = local->scan_req;
  205. struct cfg80211_chan_def chandef;
  206. enum ieee80211_band band;
  207. int i, ielen, n_chans;
  208. do {
  209. if (local->hw_scan_band == IEEE80211_NUM_BANDS)
  210. return false;
  211. band = local->hw_scan_band;
  212. n_chans = 0;
  213. for (i = 0; i < req->n_channels; i++) {
  214. if (req->channels[i]->band == band) {
  215. local->hw_scan_req->channels[n_chans] =
  216. req->channels[i];
  217. n_chans++;
  218. }
  219. }
  220. local->hw_scan_band++;
  221. } while (!n_chans);
  222. local->hw_scan_req->n_channels = n_chans;
  223. ieee80211_prepare_scan_chandef(&chandef, req->scan_width);
  224. ielen = ieee80211_build_preq_ies(local, (u8 *)local->hw_scan_req->ie,
  225. local->hw_scan_ies_bufsize,
  226. req->ie, req->ie_len, band,
  227. req->rates[band], &chandef);
  228. local->hw_scan_req->ie_len = ielen;
  229. local->hw_scan_req->no_cck = req->no_cck;
  230. return true;
  231. }
  232. static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted,
  233. bool was_hw_scan)
  234. {
  235. struct ieee80211_local *local = hw_to_local(hw);
  236. lockdep_assert_held(&local->mtx);
  237. /*
  238. * It's ok to abort a not-yet-running scan (that
  239. * we have one at all will be verified by checking
  240. * local->scan_req next), but not to complete it
  241. * successfully.
  242. */
  243. if (WARN_ON(!local->scanning && !aborted))
  244. aborted = true;
  245. if (WARN_ON(!local->scan_req))
  246. return;
  247. if (was_hw_scan && !aborted && ieee80211_prep_hw_scan(local)) {
  248. int rc;
  249. rc = drv_hw_scan(local,
  250. rcu_dereference_protected(local->scan_sdata,
  251. lockdep_is_held(&local->mtx)),
  252. local->hw_scan_req);
  253. if (rc == 0)
  254. return;
  255. }
  256. kfree(local->hw_scan_req);
  257. local->hw_scan_req = NULL;
  258. if (local->scan_req != local->int_scan_req)
  259. cfg80211_scan_done(local->scan_req, aborted);
  260. local->scan_req = NULL;
  261. rcu_assign_pointer(local->scan_sdata, NULL);
  262. local->scanning = 0;
  263. local->scan_chandef.chan = NULL;
  264. /* Set power back to normal operating levels. */
  265. ieee80211_hw_config(local, 0);
  266. if (!was_hw_scan) {
  267. ieee80211_configure_filter(local);
  268. drv_sw_scan_complete(local);
  269. ieee80211_offchannel_return(local);
  270. }
  271. ieee80211_recalc_idle(local);
  272. ieee80211_mlme_notify_scan_completed(local);
  273. ieee80211_ibss_notify_scan_completed(local);
  274. ieee80211_mesh_notify_scan_completed(local);
  275. ieee80211_start_next_roc(local);
  276. }
  277. void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
  278. {
  279. struct ieee80211_local *local = hw_to_local(hw);
  280. trace_api_scan_completed(local, aborted);
  281. set_bit(SCAN_COMPLETED, &local->scanning);
  282. if (aborted)
  283. set_bit(SCAN_ABORTED, &local->scanning);
  284. ieee80211_queue_delayed_work(&local->hw, &local->scan_work, 0);
  285. }
  286. EXPORT_SYMBOL(ieee80211_scan_completed);
  287. static int ieee80211_start_sw_scan(struct ieee80211_local *local)
  288. {
  289. /* Software scan is not supported in multi-channel cases */
  290. if (local->use_chanctx)
  291. return -EOPNOTSUPP;
  292. /*
  293. * Hardware/driver doesn't support hw_scan, so use software
  294. * scanning instead. First send a nullfunc frame with power save
  295. * bit on so that AP will buffer the frames for us while we are not
  296. * listening, then send probe requests to each channel and wait for
  297. * the responses. After all channels are scanned, tune back to the
  298. * original channel and send a nullfunc frame with power save bit
  299. * off to trigger the AP to send us all the buffered frames.
  300. *
  301. * Note that while local->sw_scanning is true everything else but
  302. * nullfunc frames and probe requests will be dropped in
  303. * ieee80211_tx_h_check_assoc().
  304. */
  305. drv_sw_scan_start(local);
  306. local->leave_oper_channel_time = jiffies;
  307. local->next_scan_state = SCAN_DECISION;
  308. local->scan_channel_idx = 0;
  309. ieee80211_offchannel_stop_vifs(local);
  310. /* ensure nullfunc is transmitted before leaving operating channel */
  311. ieee80211_flush_queues(local, NULL);
  312. ieee80211_configure_filter(local);
  313. /* We need to set power level at maximum rate for scanning. */
  314. ieee80211_hw_config(local, 0);
  315. ieee80211_queue_delayed_work(&local->hw,
  316. &local->scan_work, 0);
  317. return 0;
  318. }
  319. static bool ieee80211_can_scan(struct ieee80211_local *local,
  320. struct ieee80211_sub_if_data *sdata)
  321. {
  322. if (local->radar_detect_enabled)
  323. return false;
  324. if (!list_empty(&local->roc_list))
  325. return false;
  326. if (sdata->vif.type == NL80211_IFTYPE_STATION &&
  327. sdata->u.mgd.flags & (IEEE80211_STA_BEACON_POLL |
  328. IEEE80211_STA_CONNECTION_POLL))
  329. return false;
  330. return true;
  331. }
  332. void ieee80211_run_deferred_scan(struct ieee80211_local *local)
  333. {
  334. lockdep_assert_held(&local->mtx);
  335. if (!local->scan_req || local->scanning)
  336. return;
  337. if (!ieee80211_can_scan(local,
  338. rcu_dereference_protected(
  339. local->scan_sdata,
  340. lockdep_is_held(&local->mtx))))
  341. return;
  342. ieee80211_queue_delayed_work(&local->hw, &local->scan_work,
  343. round_jiffies_relative(0));
  344. }
  345. static void ieee80211_scan_state_send_probe(struct ieee80211_local *local,
  346. unsigned long *next_delay)
  347. {
  348. int i;
  349. struct ieee80211_sub_if_data *sdata;
  350. enum ieee80211_band band = local->hw.conf.chandef.chan->band;
  351. u32 tx_flags;
  352. tx_flags = IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
  353. if (local->scan_req->no_cck)
  354. tx_flags |= IEEE80211_TX_CTL_NO_CCK_RATE;
  355. sdata = rcu_dereference_protected(local->scan_sdata,
  356. lockdep_is_held(&local->mtx));
  357. for (i = 0; i < local->scan_req->n_ssids; i++)
  358. ieee80211_send_probe_req(
  359. sdata, NULL,
  360. local->scan_req->ssids[i].ssid,
  361. local->scan_req->ssids[i].ssid_len,
  362. local->scan_req->ie, local->scan_req->ie_len,
  363. local->scan_req->rates[band], false,
  364. tx_flags, local->hw.conf.chandef.chan, true);
  365. /*
  366. * After sending probe requests, wait for probe responses
  367. * on the channel.
  368. */
  369. *next_delay = IEEE80211_CHANNEL_TIME;
  370. local->next_scan_state = SCAN_DECISION;
  371. }
  372. static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
  373. struct cfg80211_scan_request *req)
  374. {
  375. struct ieee80211_local *local = sdata->local;
  376. int rc;
  377. lockdep_assert_held(&local->mtx);
  378. if (local->scan_req)
  379. return -EBUSY;
  380. if (!ieee80211_can_scan(local, sdata)) {
  381. /* wait for the work to finish/time out */
  382. local->scan_req = req;
  383. rcu_assign_pointer(local->scan_sdata, sdata);
  384. return 0;
  385. }
  386. if (local->ops->hw_scan) {
  387. u8 *ies;
  388. local->hw_scan_ies_bufsize = 2 + IEEE80211_MAX_SSID_LEN +
  389. local->scan_ies_len +
  390. req->ie_len;
  391. local->hw_scan_req = kmalloc(
  392. sizeof(*local->hw_scan_req) +
  393. req->n_channels * sizeof(req->channels[0]) +
  394. local->hw_scan_ies_bufsize, GFP_KERNEL);
  395. if (!local->hw_scan_req)
  396. return -ENOMEM;
  397. local->hw_scan_req->ssids = req->ssids;
  398. local->hw_scan_req->n_ssids = req->n_ssids;
  399. ies = (u8 *)local->hw_scan_req +
  400. sizeof(*local->hw_scan_req) +
  401. req->n_channels * sizeof(req->channels[0]);
  402. local->hw_scan_req->ie = ies;
  403. local->hw_scan_req->flags = req->flags;
  404. local->hw_scan_band = 0;
  405. /*
  406. * After allocating local->hw_scan_req, we must
  407. * go through until ieee80211_prep_hw_scan(), so
  408. * anything that might be changed here and leave
  409. * this function early must not go after this
  410. * allocation.
  411. */
  412. }
  413. local->scan_req = req;
  414. rcu_assign_pointer(local->scan_sdata, sdata);
  415. if (local->ops->hw_scan) {
  416. __set_bit(SCAN_HW_SCANNING, &local->scanning);
  417. } else if ((req->n_channels == 1) &&
  418. (req->channels[0] == local->_oper_chandef.chan)) {
  419. /*
  420. * If we are scanning only on the operating channel
  421. * then we do not need to stop normal activities
  422. */
  423. unsigned long next_delay;
  424. __set_bit(SCAN_ONCHANNEL_SCANNING, &local->scanning);
  425. ieee80211_recalc_idle(local);
  426. /* Notify driver scan is starting, keep order of operations
  427. * same as normal software scan, in case that matters. */
  428. drv_sw_scan_start(local);
  429. ieee80211_configure_filter(local); /* accept probe-responses */
  430. /* We need to ensure power level is at max for scanning. */
  431. ieee80211_hw_config(local, 0);
  432. if ((req->channels[0]->flags &
  433. IEEE80211_CHAN_PASSIVE_SCAN) ||
  434. !local->scan_req->n_ssids) {
  435. next_delay = IEEE80211_PASSIVE_CHANNEL_TIME;
  436. } else {
  437. ieee80211_scan_state_send_probe(local, &next_delay);
  438. next_delay = IEEE80211_CHANNEL_TIME;
  439. }
  440. /* Now, just wait a bit and we are all done! */
  441. ieee80211_queue_delayed_work(&local->hw, &local->scan_work,
  442. next_delay);
  443. return 0;
  444. } else {
  445. /* Do normal software scan */
  446. __set_bit(SCAN_SW_SCANNING, &local->scanning);
  447. }
  448. ieee80211_recalc_idle(local);
  449. if (local->ops->hw_scan) {
  450. WARN_ON(!ieee80211_prep_hw_scan(local));
  451. rc = drv_hw_scan(local, sdata, local->hw_scan_req);
  452. } else
  453. rc = ieee80211_start_sw_scan(local);
  454. if (rc) {
  455. kfree(local->hw_scan_req);
  456. local->hw_scan_req = NULL;
  457. local->scanning = 0;
  458. ieee80211_recalc_idle(local);
  459. local->scan_req = NULL;
  460. rcu_assign_pointer(local->scan_sdata, NULL);
  461. }
  462. return rc;
  463. }
  464. static unsigned long
  465. ieee80211_scan_get_channel_time(struct ieee80211_channel *chan)
  466. {
  467. /*
  468. * TODO: channel switching also consumes quite some time,
  469. * add that delay as well to get a better estimation
  470. */
  471. if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
  472. return IEEE80211_PASSIVE_CHANNEL_TIME;
  473. return IEEE80211_PROBE_DELAY + IEEE80211_CHANNEL_TIME;
  474. }
  475. static void ieee80211_scan_state_decision(struct ieee80211_local *local,
  476. unsigned long *next_delay)
  477. {
  478. bool associated = false;
  479. bool tx_empty = true;
  480. bool bad_latency;
  481. struct ieee80211_sub_if_data *sdata;
  482. struct ieee80211_channel *next_chan;
  483. enum mac80211_scan_state next_scan_state;
  484. /*
  485. * check if at least one STA interface is associated,
  486. * check if at least one STA interface has pending tx frames
  487. * and grab the lowest used beacon interval
  488. */
  489. mutex_lock(&local->iflist_mtx);
  490. list_for_each_entry(sdata, &local->interfaces, list) {
  491. if (!ieee80211_sdata_running(sdata))
  492. continue;
  493. if (sdata->vif.type == NL80211_IFTYPE_STATION) {
  494. if (sdata->u.mgd.associated) {
  495. associated = true;
  496. if (!qdisc_all_tx_empty(sdata->dev)) {
  497. tx_empty = false;
  498. break;
  499. }
  500. }
  501. }
  502. }
  503. mutex_unlock(&local->iflist_mtx);
  504. next_chan = local->scan_req->channels[local->scan_channel_idx];
  505. /*
  506. * we're currently scanning a different channel, let's
  507. * see if we can scan another channel without interfering
  508. * with the current traffic situation.
  509. *
  510. * Keep good latency, do not stay off-channel more than 125 ms.
  511. */
  512. bad_latency = time_after(jiffies +
  513. ieee80211_scan_get_channel_time(next_chan),
  514. local->leave_oper_channel_time + HZ / 8);
  515. if (associated && !tx_empty) {
  516. if (local->scan_req->flags & NL80211_SCAN_FLAG_LOW_PRIORITY)
  517. next_scan_state = SCAN_ABORT;
  518. else
  519. next_scan_state = SCAN_SUSPEND;
  520. } else if (associated && bad_latency) {
  521. next_scan_state = SCAN_SUSPEND;
  522. } else {
  523. next_scan_state = SCAN_SET_CHANNEL;
  524. }
  525. local->next_scan_state = next_scan_state;
  526. *next_delay = 0;
  527. }
  528. static void ieee80211_scan_state_set_channel(struct ieee80211_local *local,
  529. unsigned long *next_delay)
  530. {
  531. int skip;
  532. struct ieee80211_channel *chan;
  533. enum nl80211_bss_scan_width oper_scan_width;
  534. skip = 0;
  535. chan = local->scan_req->channels[local->scan_channel_idx];
  536. local->scan_chandef.chan = chan;
  537. local->scan_chandef.center_freq1 = chan->center_freq;
  538. local->scan_chandef.center_freq2 = 0;
  539. switch (local->scan_req->scan_width) {
  540. case NL80211_BSS_CHAN_WIDTH_5:
  541. local->scan_chandef.width = NL80211_CHAN_WIDTH_5;
  542. break;
  543. case NL80211_BSS_CHAN_WIDTH_10:
  544. local->scan_chandef.width = NL80211_CHAN_WIDTH_10;
  545. break;
  546. case NL80211_BSS_CHAN_WIDTH_20:
  547. /* If scanning on oper channel, use whatever channel-type
  548. * is currently in use.
  549. */
  550. oper_scan_width = cfg80211_chandef_to_scan_width(
  551. &local->_oper_chandef);
  552. if (chan == local->_oper_chandef.chan &&
  553. oper_scan_width == local->scan_req->scan_width)
  554. local->scan_chandef = local->_oper_chandef;
  555. else
  556. local->scan_chandef.width = NL80211_CHAN_WIDTH_20_NOHT;
  557. break;
  558. }
  559. if (ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL))
  560. skip = 1;
  561. /* advance state machine to next channel/band */
  562. local->scan_channel_idx++;
  563. if (skip) {
  564. /* if we skip this channel return to the decision state */
  565. local->next_scan_state = SCAN_DECISION;
  566. return;
  567. }
  568. /*
  569. * Probe delay is used to update the NAV, cf. 11.1.3.2.2
  570. * (which unfortunately doesn't say _why_ step a) is done,
  571. * but it waits for the probe delay or until a frame is
  572. * received - and the received frame would update the NAV).
  573. * For now, we do not support waiting until a frame is
  574. * received.
  575. *
  576. * In any case, it is not necessary for a passive scan.
  577. */
  578. if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN ||
  579. !local->scan_req->n_ssids) {
  580. *next_delay = IEEE80211_PASSIVE_CHANNEL_TIME;
  581. local->next_scan_state = SCAN_DECISION;
  582. return;
  583. }
  584. /* active scan, send probes */
  585. *next_delay = IEEE80211_PROBE_DELAY;
  586. local->next_scan_state = SCAN_SEND_PROBE;
  587. }
  588. static void ieee80211_scan_state_suspend(struct ieee80211_local *local,
  589. unsigned long *next_delay)
  590. {
  591. /* switch back to the operating channel */
  592. local->scan_chandef.chan = NULL;
  593. ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
  594. /* disable PS */
  595. ieee80211_offchannel_return(local);
  596. *next_delay = HZ / 5;
  597. /* afterwards, resume scan & go to next channel */
  598. local->next_scan_state = SCAN_RESUME;
  599. }
  600. static void ieee80211_scan_state_resume(struct ieee80211_local *local,
  601. unsigned long *next_delay)
  602. {
  603. ieee80211_offchannel_stop_vifs(local);
  604. if (local->ops->flush) {
  605. ieee80211_flush_queues(local, NULL);
  606. *next_delay = 0;
  607. } else
  608. *next_delay = HZ / 10;
  609. /* remember when we left the operating channel */
  610. local->leave_oper_channel_time = jiffies;
  611. /* advance to the next channel to be scanned */
  612. local->next_scan_state = SCAN_SET_CHANNEL;
  613. }
  614. void ieee80211_scan_work(struct work_struct *work)
  615. {
  616. struct ieee80211_local *local =
  617. container_of(work, struct ieee80211_local, scan_work.work);
  618. struct ieee80211_sub_if_data *sdata;
  619. unsigned long next_delay = 0;
  620. bool aborted, hw_scan;
  621. mutex_lock(&local->mtx);
  622. sdata = rcu_dereference_protected(local->scan_sdata,
  623. lockdep_is_held(&local->mtx));
  624. /* When scanning on-channel, the first-callback means completed. */
  625. if (test_bit(SCAN_ONCHANNEL_SCANNING, &local->scanning)) {
  626. aborted = test_and_clear_bit(SCAN_ABORTED, &local->scanning);
  627. goto out_complete;
  628. }
  629. if (test_and_clear_bit(SCAN_COMPLETED, &local->scanning)) {
  630. aborted = test_and_clear_bit(SCAN_ABORTED, &local->scanning);
  631. goto out_complete;
  632. }
  633. if (!sdata || !local->scan_req)
  634. goto out;
  635. if (local->scan_req && !local->scanning) {
  636. struct cfg80211_scan_request *req = local->scan_req;
  637. int rc;
  638. local->scan_req = NULL;
  639. rcu_assign_pointer(local->scan_sdata, NULL);
  640. rc = __ieee80211_start_scan(sdata, req);
  641. if (rc) {
  642. /* need to complete scan in cfg80211 */
  643. local->scan_req = req;
  644. aborted = true;
  645. goto out_complete;
  646. } else
  647. goto out;
  648. }
  649. /*
  650. * Avoid re-scheduling when the sdata is going away.
  651. */
  652. if (!ieee80211_sdata_running(sdata)) {
  653. aborted = true;
  654. goto out_complete;
  655. }
  656. /*
  657. * as long as no delay is required advance immediately
  658. * without scheduling a new work
  659. */
  660. do {
  661. if (!ieee80211_sdata_running(sdata)) {
  662. aborted = true;
  663. goto out_complete;
  664. }
  665. switch (local->next_scan_state) {
  666. case SCAN_DECISION:
  667. /* if no more bands/channels left, complete scan */
  668. if (local->scan_channel_idx >= local->scan_req->n_channels) {
  669. aborted = false;
  670. goto out_complete;
  671. }
  672. ieee80211_scan_state_decision(local, &next_delay);
  673. break;
  674. case SCAN_SET_CHANNEL:
  675. ieee80211_scan_state_set_channel(local, &next_delay);
  676. break;
  677. case SCAN_SEND_PROBE:
  678. ieee80211_scan_state_send_probe(local, &next_delay);
  679. break;
  680. case SCAN_SUSPEND:
  681. ieee80211_scan_state_suspend(local, &next_delay);
  682. break;
  683. case SCAN_RESUME:
  684. ieee80211_scan_state_resume(local, &next_delay);
  685. break;
  686. case SCAN_ABORT:
  687. aborted = true;
  688. goto out_complete;
  689. }
  690. } while (next_delay == 0);
  691. ieee80211_queue_delayed_work(&local->hw, &local->scan_work, next_delay);
  692. goto out;
  693. out_complete:
  694. hw_scan = test_bit(SCAN_HW_SCANNING, &local->scanning);
  695. __ieee80211_scan_completed(&local->hw, aborted, hw_scan);
  696. out:
  697. mutex_unlock(&local->mtx);
  698. }
  699. int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
  700. struct cfg80211_scan_request *req)
  701. {
  702. int res;
  703. mutex_lock(&sdata->local->mtx);
  704. res = __ieee80211_start_scan(sdata, req);
  705. mutex_unlock(&sdata->local->mtx);
  706. return res;
  707. }
  708. int ieee80211_request_ibss_scan(struct ieee80211_sub_if_data *sdata,
  709. const u8 *ssid, u8 ssid_len,
  710. struct ieee80211_channel *chan,
  711. enum nl80211_bss_scan_width scan_width)
  712. {
  713. struct ieee80211_local *local = sdata->local;
  714. int ret = -EBUSY;
  715. enum ieee80211_band band;
  716. mutex_lock(&local->mtx);
  717. /* busy scanning */
  718. if (local->scan_req)
  719. goto unlock;
  720. /* fill internal scan request */
  721. if (!chan) {
  722. int i, max_n;
  723. int n_ch = 0;
  724. for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
  725. if (!local->hw.wiphy->bands[band])
  726. continue;
  727. max_n = local->hw.wiphy->bands[band]->n_channels;
  728. for (i = 0; i < max_n; i++) {
  729. struct ieee80211_channel *tmp_ch =
  730. &local->hw.wiphy->bands[band]->channels[i];
  731. if (tmp_ch->flags & (IEEE80211_CHAN_NO_IBSS |
  732. IEEE80211_CHAN_DISABLED))
  733. continue;
  734. local->int_scan_req->channels[n_ch] = tmp_ch;
  735. n_ch++;
  736. }
  737. }
  738. if (WARN_ON_ONCE(n_ch == 0))
  739. goto unlock;
  740. local->int_scan_req->n_channels = n_ch;
  741. } else {
  742. if (WARN_ON_ONCE(chan->flags & (IEEE80211_CHAN_NO_IBSS |
  743. IEEE80211_CHAN_DISABLED)))
  744. goto unlock;
  745. local->int_scan_req->channels[0] = chan;
  746. local->int_scan_req->n_channels = 1;
  747. }
  748. local->int_scan_req->ssids = &local->scan_ssid;
  749. local->int_scan_req->n_ssids = 1;
  750. local->int_scan_req->scan_width = scan_width;
  751. memcpy(local->int_scan_req->ssids[0].ssid, ssid, IEEE80211_MAX_SSID_LEN);
  752. local->int_scan_req->ssids[0].ssid_len = ssid_len;
  753. ret = __ieee80211_start_scan(sdata, sdata->local->int_scan_req);
  754. unlock:
  755. mutex_unlock(&local->mtx);
  756. return ret;
  757. }
  758. /*
  759. * Only call this function when a scan can't be queued -- under RTNL.
  760. */
  761. void ieee80211_scan_cancel(struct ieee80211_local *local)
  762. {
  763. /*
  764. * We are canceling software scan, or deferred scan that was not
  765. * yet really started (see __ieee80211_start_scan ).
  766. *
  767. * Regarding hardware scan:
  768. * - we can not call __ieee80211_scan_completed() as when
  769. * SCAN_HW_SCANNING bit is set this function change
  770. * local->hw_scan_req to operate on 5G band, what race with
  771. * driver which can use local->hw_scan_req
  772. *
  773. * - we can not cancel scan_work since driver can schedule it
  774. * by ieee80211_scan_completed(..., true) to finish scan
  775. *
  776. * Hence we only call the cancel_hw_scan() callback, but the low-level
  777. * driver is still responsible for calling ieee80211_scan_completed()
  778. * after the scan was completed/aborted.
  779. */
  780. mutex_lock(&local->mtx);
  781. if (!local->scan_req)
  782. goto out;
  783. if (test_bit(SCAN_HW_SCANNING, &local->scanning)) {
  784. if (local->ops->cancel_hw_scan)
  785. drv_cancel_hw_scan(local,
  786. rcu_dereference_protected(local->scan_sdata,
  787. lockdep_is_held(&local->mtx)));
  788. goto out;
  789. }
  790. /*
  791. * If the work is currently running, it must be blocked on
  792. * the mutex, but we'll set scan_sdata = NULL and it'll
  793. * simply exit once it acquires the mutex.
  794. */
  795. cancel_delayed_work(&local->scan_work);
  796. /* and clean up */
  797. __ieee80211_scan_completed(&local->hw, true, false);
  798. out:
  799. mutex_unlock(&local->mtx);
  800. }
  801. int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
  802. struct cfg80211_sched_scan_request *req)
  803. {
  804. struct ieee80211_local *local = sdata->local;
  805. struct ieee80211_sched_scan_ies sched_scan_ies = {};
  806. struct cfg80211_chan_def chandef;
  807. int ret, i, iebufsz;
  808. iebufsz = 2 + IEEE80211_MAX_SSID_LEN +
  809. local->scan_ies_len + req->ie_len;
  810. mutex_lock(&local->mtx);
  811. if (rcu_access_pointer(local->sched_scan_sdata)) {
  812. ret = -EBUSY;
  813. goto out;
  814. }
  815. if (!local->ops->sched_scan_start) {
  816. ret = -ENOTSUPP;
  817. goto out;
  818. }
  819. for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
  820. if (!local->hw.wiphy->bands[i])
  821. continue;
  822. sched_scan_ies.ie[i] = kzalloc(iebufsz, GFP_KERNEL);
  823. if (!sched_scan_ies.ie[i]) {
  824. ret = -ENOMEM;
  825. goto out_free;
  826. }
  827. ieee80211_prepare_scan_chandef(&chandef, req->scan_width);
  828. sched_scan_ies.len[i] =
  829. ieee80211_build_preq_ies(local, sched_scan_ies.ie[i],
  830. iebufsz, req->ie, req->ie_len,
  831. i, (u32) -1, &chandef);
  832. }
  833. ret = drv_sched_scan_start(local, sdata, req, &sched_scan_ies);
  834. if (ret == 0)
  835. rcu_assign_pointer(local->sched_scan_sdata, sdata);
  836. out_free:
  837. while (i > 0)
  838. kfree(sched_scan_ies.ie[--i]);
  839. out:
  840. mutex_unlock(&local->mtx);
  841. return ret;
  842. }
  843. int ieee80211_request_sched_scan_stop(struct ieee80211_sub_if_data *sdata)
  844. {
  845. struct ieee80211_local *local = sdata->local;
  846. int ret = 0;
  847. mutex_lock(&local->mtx);
  848. if (!local->ops->sched_scan_stop) {
  849. ret = -ENOTSUPP;
  850. goto out;
  851. }
  852. if (rcu_access_pointer(local->sched_scan_sdata))
  853. drv_sched_scan_stop(local, sdata);
  854. out:
  855. mutex_unlock(&local->mtx);
  856. return ret;
  857. }
  858. void ieee80211_sched_scan_results(struct ieee80211_hw *hw)
  859. {
  860. struct ieee80211_local *local = hw_to_local(hw);
  861. trace_api_sched_scan_results(local);
  862. cfg80211_sched_scan_results(hw->wiphy);
  863. }
  864. EXPORT_SYMBOL(ieee80211_sched_scan_results);
  865. void ieee80211_sched_scan_stopped_work(struct work_struct *work)
  866. {
  867. struct ieee80211_local *local =
  868. container_of(work, struct ieee80211_local,
  869. sched_scan_stopped_work);
  870. mutex_lock(&local->mtx);
  871. if (!rcu_access_pointer(local->sched_scan_sdata)) {
  872. mutex_unlock(&local->mtx);
  873. return;
  874. }
  875. rcu_assign_pointer(local->sched_scan_sdata, NULL);
  876. mutex_unlock(&local->mtx);
  877. cfg80211_sched_scan_stopped(local->hw.wiphy);
  878. }
  879. void ieee80211_sched_scan_stopped(struct ieee80211_hw *hw)
  880. {
  881. struct ieee80211_local *local = hw_to_local(hw);
  882. trace_api_sched_scan_stopped(local);
  883. ieee80211_queue_work(&local->hw, &local->sched_scan_stopped_work);
  884. }
  885. EXPORT_SYMBOL(ieee80211_sched_scan_stopped);